Responsible Disclosure Policy

This policy applies to internet-facing systems owned or operated by Interlock (interlockroofing.com and related properties). Out of scope: third-party services we do not control, physical attacks, social engineering of staff or dealers, and denial-of-service.

Email [email protected] with steps to reproduce, the affected URL or endpoint, and the impact. A machine-readable /.well-known/security.txt advertises this contact.

Act in good faith; avoid privacy violations, data destruction, and service disruption; only interact with accounts you own or have permission to test; do not exfiltrate more data than necessary to demonstrate the issue; and give us reasonable time to remediate before public disclosure. Research conducted consistent with this policy is authorized, and we will not pursue or support legal action against you for it.

We aim to acknowledge reports within 3–5 business days, provide an assessment, and keep you updated through remediation. We do not currently operate a paid bug-bounty program; we are happy to credit reporters who wish it.

Do not access, modify, or delete others' data; do not publicly disclose before we have remediated; and do not use findings for any purpose other than good-faith reporting.